up vote 1 down vote favorite
share [g+] share [fb]

Has anyone seen this where a computer account appears to reset its password?

The password for user 'WEST\SQLCLUSTER$' was reset by 'WEST\SQLCLUSTER$' on 'DOMAINCONTROLLER.WEST.company.corp' at '04/23/10 20:47:41'
Event Type: Success Audit

Event Source: Security

Event Category: Account Management

Event ID: 628

Date: Friday, April 23, 2010

Time: 8:47 PM

User: WEST\SQLCLUSTER$

Computer: DOMAINCONTROLLER.WEST.company.corp

Description: User Account password set:

     Target Account Name:        SQLCLUSTER$

     Target Domain:      WEST

     Target Account ID:      WEST\SQLCLUSTER$

     Caller User Name:       SQLCLUSTER$

     Caller Domain:      WEST

     Caller Logon ID:        (0x0,0x7A518945)
link|improve this question
feedback

1 Answer

up vote 4 down vote

This is expected, normal, and good. Any computer running Windows 2000 or later will automatically change its computer account password every 30 days. This is a security mechanism. See this blog post for more info.

link|improve this answer
I'm not sure that this is the case, I generated a report of event ID 628's over the past 2 months and I don't see any other computer accounts changing passwords. Only the computer listed in the example has done so and it's changed the password 3 or 4 times since the beginning of March. – David Yu May 3 '10 at 21:10
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.